A system of record that maintains itself

You already said it. Stop typing it in again.

Every tracker you have ever abandoned died the same way. The work happened — and then somebody was supposed to go and write down that it happened. StratOps removes the second step. You talk to Claude about work that already occurred, and the record updates as a byproduct of the sentence.

It is not a project manager with a chat box bolted on. The differentiator is that nobody does data entry. Built for operators who already run their work — and their life — through Claude every day.

Write to Jake See what one sentence writes

There is no signup form on this page because there is no signup. The button writes to a human.

It is deployed. Check that before you read another word.

$ curl https://stratops.stratops.workers.dev/health
{"ok":true,"environment":"production"}

01

The cost you already pay

The work happened. The record of it did not.

Here is a Tuesday you have had.

9:40 You tell Claude about the call with Sarah at Acme. They want the pilot. You owe her a proposal by Friday. The reason they moved is the migration cost, not the price — and you say that out loud, because it matters.
11:15 Three hours on the onboarding flow. It ships. You mention it in passing.
2:00 You decide against the more expensive vendor, and you articulate exactly why — better than you will ever articulate it again.

By Friday the proposal is late, because nothing was tracking it. Sarah is in no CRM, because putting her there would have meant retyping a name you had already said. And in November, when someone asks why you went with the cheaper vendor, the honest answer is "I remember there being a good reason."

None of that is a discipline problem. You did the work and you described it precisely, the first time. The cost is that every system you own asks for a second pass, and the second pass is the one that never happens. That is how every tracker you have abandoned actually died — not because the software was bad, but because it sat downstream of a step no busy person performs.

Scrollback is not a system of record. It has no schema, no sortable dates, no answer to what moved this week, and it disappears.

StratOps does not give you another place to type. It removes the second typing.

02

Setup

Three steps, and then you stop thinking about it.

01

Connect it once.

StratOps is an MCP connector, not an app. In Claude: Settings → Connectors → Add custom connector. A URL ending in /mcp, and one Authorization header. Two fields. Nothing to install, no account to create, no second place to go and check. Claude gains thirty tools — eleven that read, nineteen that write.

Being exact about what you cannot do today: there is one deployment, a Cloudflare Worker over a D1 database in the Cloudflare account of the person who built it. There is no self-serve way to stand up your own. That is part of what "not for sale" means in practice, and it is the reason the button on this page is an email address.

02

Talk about work that already happened.

Past tense, in your own words, in the conversation you were already having. There is no syntax to learn. Each write tool is named for the past-tense verb in your sentence, so one sentence costs one permission prompt instead of six — Claude shows you exactly what it is about to record, and you approve once. The eleven read tools carry no prompt at all. That asymmetry is deliberate: asking should be free, and writing should always be visible.

03

Ask it back.

Whenever you want, in the same conversation. There is no dashboard to keep current because there is nothing to keep current — health, momentum and throughput are recomputed from an append-only trail of state changes at the instant you ask, so no score sits in a column going stale. Nothing is scheduled and nothing arrives unprompted. It answers when you ask, and only then. That is a limitation, and it is also why there is no background process anywhere holding access to your record: there is no background process.

Write to Jake Tell me what you run and how much of it already goes through Claude.

03

The whole product, in one exchange

One sentence. One approval. Four records.

These are not mocked-up screens. Each is a real call to a real tool, writing real rows — the same three moments from that Tuesday. Everything is resolved and checked before a single row is written, so a capture that gets refused leaves nothing behind at all.

You say

Just got off a call with Sarah at Acme. They want the pilot, and I owe her a proposal by Friday.

Claude asks once, for log_meeting. You approve once.

What lands in the record

meeting Acme pilot call — dated when it happened, never invented. The field is required with no default, so if you did not say when, you get asked. Everything below links back to it.
contact Sarah, Acme — matched to the Sarah you already have, or created if she is new.
deal Acme pilot — moved to its new stage rather than duplicated, with the stage change written to a trail, so "how long has this been sitting in proposal" stays answerable later.
task Send Sarah the proposal — due Friday in your workspace's own timezone, attributed to the call it came out of.

If "Sarah" could be two people you already know, it stops and names both. It does not pick one. A near-duplicate contact splits that person's deals and meetings across two records, and that is not something you can talk your way back out of.

You say

Spent about three hours on the onboarding flow this afternoon, and it is out.

One call to log_time.

timeThree hours against today, in your own calendar day.
taskOnboarding flow moved to completed, and the move written to the trail.
shippedA changelog entry — which is what next week's review counts as shipped.

All of it goes down in one batch, so a failure cannot leave the task completed while you are told the call failed.

You say

We are going with the cheaper vendor because the migration cost is the real risk. Look at it again in November.

One call to record_decision.

decisionThe context, the option taken, and why that one.
reviewA November date, so it resurfaces instead of being quietly forgotten.
outcomeLeft blank on purpose. In November you say how it went, and that gets recorded then.

Write to Jake One address, a person on the end of it, no list to unsubscribe from.

04

Reading

Questions, not screens.

The reads are named for the question a person actually asks, and each one assembles the whole answer across tables instead of handing you a fragment to join yourself. Reads never ask permission, which is what makes them worth using at all.

"What should I work on?"

Overdue, due today, in flight, stalled, and how heavy the days ahead look. Due today is not reported as late, because the day boundary comes from your workspace's timezone rather than from UTC.
"What actually happened last week?"

What shipped, what completed, what stalled, hours by initiative, deals that changed stage, and whether throughput is accelerating or slowing. Announced and measured are two separate figures on purpose — the two disagreeing is usually the finding.
"Why did we decide that in March?"

The decision, its context, the option chosen, the reasoning, and how it turned out. When nothing formal matches, it returns the nearest notes and meetings and labels them as exactly that, rather than returning nothing.
"Everything you have on Acme."

Deals with stage and value, meetings and what came out of them, notes, open tasks, last contact, and which initiatives they touch. Keyword mentions are labelled as mentions, not passed off as real links.
"How is the pilot doing?"

Health and momentum, each with the component breakdown that produced it, north-star progress, stalled work, hours, recent shipments, open decisions. When a component cannot be measured it comes back empty with a reason — never a placeholder number.
"What is in the pipeline?"

Open and recently closed deals by stage, with value, probability, expected close and time in stage. Totals both raw and probability-weighted, bucketed per currency, because summing minor units across currencies produces a number that is wrong in a way nobody can see.

05

Who this is for, and who should stop reading.

A product with one seat and no signup needs to release the wrong reader early rather than late. This is that block, and it is deliberately placed before the long ones.

This is for you if

You already run a real share of your work through Claude, and the conversation is where the thinking actually happens.
You are one person carrying the whole picture — the deals, the delivery, the decisions and the reason behind each one.
You have abandoned at least two trackers, and you know exactly which step killed each one.
You would rather be told a number cannot be computed yet than be shown one that was invented.

This is not for you if

You need a shared team record. One person per account, and a second user cannot sign up today. That is not a setting.
You need to buy it. There is no price, no plan, no trial and no way to pay.
Your procurement asks for a certification. There is none, and none is in progress.
You want a screen to look at. There is no dashboard, and no intention to build a fake one to have something to show you.
You want something that watches and tells you. Nothing runs on a schedule.

If three of those five apply to you, we are both better off knowing now, and nothing on this page is going to change in the next few months.

06

Instead of a badge

Numbers you can re-run, not logos you have to trust.

There are no customer logos on this page, no star rating and no testimonial, because there are no customers. What exists instead is a set of artifacts that each produce a number when you run them. Two of them you can check right now, from any terminal, with nothing from me. The rest I will hand you. Then there is what there isn't.

Tier one — check these before you reply

It is deployed.

$ curl https://stratops.stratops.workers.dev/health
{"ok":true,"environment":"production"}

It refuses browsers, by design.

$ curl -i -X POST -H 'Origin: https://example.com' \
    https://stratops.stratops.workers.dev/mcp
HTTP/1.1 403 Forbidden
{"error":"Browser origins are not permitted on this endpoint"}

Claude connects from Anthropic's infrastructure and sends no Origin; a browser always sends one on a cross-origin request. So a page in a tab cannot reach the record — including this page. Now be precise about what that buys, because the project's own audit is: it stops the browser class of attack, and it does nothing at all against a non-browser caller, who simply omits the header. It is a correct control for what it targets, and it is not authentication.

Tier two — ask, and I will send you the file

47 of 55

Deliberate cross-account attacks refused by the database itself. A probe builds two accounts against the actual migration files, turns foreign keys on, and tries to write account A's row into account B's data across all 27 tables. 47 are rejected outright — by composite keys that make a row claiming one account while pointing at another's workspace structurally invalid, and by triggers that name the offending column. The other 8 are six columns that can point at any kind of record, where no such key can exist in SQLite; those are checked in code before every write and re-scoped again on every read. It is one command, and it then runs the whole set a second time with enforcement off, to show which protections were real constraints and which were only triggers.
266 of 266

Automated checks passing, plus a separate 266-assertion self-test for the data migration, kept in its own runner so the two never race. Flagging that out loud because it looks manufactured: they are two different suites that happen to have landed on the same count. I ran both. It is a coincidence, not a copy-paste.
30 tools

Eleven read, nineteen write. No tool is read-only and writing behind a method parameter. Every one declares whether it can overwrite something that existed before the call, which is what lets the reads run without a prompt.
0 runtime dependencies

The MCP protocol is implemented directly over JSON-RPC. Nothing is pulled in at runtime, so there is no supply chain to inherit. There is also not a single log statement anywhere in the source, so no record body and no token has ever reached a log line.

What the audit found, and nobody has fixed

The isolation work has its own written audit — the author's own, not an independent one — and its top recommendation is not implemented. 22 of those 27 tables depend on Cloudflare's D1 continuing to enforce foreign keys. That is documented vendor behaviour, checked against the docs, but nothing in the running system verifies it is still true. Run the same probe with enforcement off and those 22 protections vanish, while the trigger-guarded references survive untouched — the layer everyone assumes is stronger is the layer with the external dependency, and that asymmetry is the finding. A production canary for it is item one on the fix list, and it is not built. There is also no audit log — nothing anywhere records who read what.

On a one-person database both are academic. Before a second person exists they are not, which is why they are written here rather than left for you to find.

One thing this page will not do is invite you to go and run the probe yourself, because you cannot: the repository is not public. Pushing it to GitHub is an open item on the project's own list, not a policy. Until then the offer is literal — ask, and you get the probe, the API reference and the isolation audit, before you have committed anything to this.

Write to Jake Ask for the probe, the API reference and the isolation audit.

07

Status, plainly

What is actually running, as of today.

The predecessor is in daily use, the rebuild is deployed and empty, and the cutover has not happened.

StratOps answers on Cloudflare Workers against a D1 database, and /health reports production. But it is a rebuild, and the system it replaces is still one operator's live system of record. That system holds 8,628 rows across 23 tables, and every creation timestamp in it falls between 2026-02-19 and today — six months, not the two years this page was handed as approved copy. One meeting is backdated to April 2025; nothing else predates February.

The part of those rows written by a human rather than by a machine is 564 changelog entries, 506 tasks, 190 notes, 112 decisions, 88 knowledge entries, 68 contacts and 21 meetings. The remaining 6,603 are alert firings the old system's checker produced on its own — sixteen configured alerts, 6,603 events — and they are counted separately here because quoting the total as though it were all hand-made work would overstate it by a factor of four. Those six months are why the schema looks the way it does: it was shaped by data that already existed, and three separate times the real rows disproved what the code implied they held — each time the schema was corrected to match the data, rather than the data mangled to fit a constraint invented during a rebuild.

That record has been exported, has passed a preflight against the live system, and the loader has produced its output. Loading it into the new database is the next step and has not been run. The loader carries the 266-assertion self-test above, and it has never touched production.

So the person who wrote it is the only user, on a system that is not yet the one described on this page. That is the entire customer list. Dressing it up as anything else would undercut the one thing this page is actually selling.

08

The part other pages leave out

Where it stops.

If you are weighing whether to put your working life into something, these are the facts that decide it. Every line describes today. None of it describes a roadmap.

One person per account.: The account row is the identity — there is no user table, no session table, no member table and no role table in any migration. No seats, no roles, no invitations, and no signup at all. Today a second person cannot obtain a credential except by an operator editing the database by hand, and the credential logic deliberately refuses to guess which account a token meant the moment a second account exists. A second user needs OAuth, and OAuth is designed and not built.
There is no dashboard.: Talking is the whole surface. Two HTTP routes exist and neither serves a page; there is no web app and no mobile app. Three things deliberately cannot be done by talking — uploading a file, connecting Google or a bank through an OAuth redirect, and issuing the credential an inbound feed would need — and the web page they belong on does not exist.
Nothing runs on a schedule.: You can configure an alert and it is stored faithfully, but no checker exists, so it can never fire. The same is true of signals. Nothing arrives while you are asleep, and nothing is watching in the background. The tools' own shipped descriptions mention a checker and a detection engine; those components do not exist, and the API reference says so rather than leaving you to find out.
Documents are filenames.: A document can be recorded and linked. Its contents are not stored and not searched, and there is no upload path. Search reads the words you said, not the inside of a PDF.
Claude reaches your email. StratOps does not.: There is no integrations directory here and no connector list. When Claude reads your Gmail or your calendar in the same conversation, that is Claude's own connector doing it — not this, which neither sees nor stores what comes back. It is the easiest true-sounding thing to imply on a page like this, so it is being said outright.
Day one is honestly empty, and an import does not fix it.: An empty account says so: health comes back with a reason rather than a number. An account holding imported rows and no recent history is worse, because it returns real arithmetic that does not mean anything yet. Half of momentum is what completed in the last seven days, so loading a body of finished work scores zero on the largest component and the number cannot climb until you actually do something. This was measured rather than assumed: run the real analytics over wizard-seeded data and you get momentum 50, health 23, velocity "stable" at zero — four numbers, every one an artifact, presented with the same confidence as real ones. Capture and recall work from the first sentence. The derived numbers take a few weeks of actually talking to it.
The undo reaches one step back.: retract_capture undoes the most recent capture. Not any past write, and not a contact — contacts have no undo at all, which is why an ambiguous name is refused rather than guessed. There is no version history and no trash.
No export button, and no lock-in either.: There is no export tool and no route — that is a real gap, not a boast. What there is instead is the shape of the storage: the rows are in a D1 database, which is SQL, and whoever holds the Cloudflare account can query them directly with wrangler without StratOps being involved. No proprietary format, and nothing to be revoked.
It is not for sale.: No price, no plan, no trial, no free tier, and nothing withheld from this page as a tactic. It is built and run by Jake Hodges, for one operator.

Write to Jake If you read that list and still want in, you are the reader this is for.

09

Objections

The questions you are actually asking.

Answered in full rather than hidden behind a click, because the answers are the argument. One rule applied throughout: where the honest answer is no, the answer begins with the word no.

An AI is writing to my records. What stops it writing something wrong?

Three things, in order of how much they matter. You approve every write. All nineteen write tools declare themselves as writing, so Claude shows you a prompt naming exactly what it is about to record, every time. Nothing lands silently; only the eleven reads run without a prompt. Writes validate before they write. log_meeting runs in two phases — phase one resolves and checks everything you supplied, every task title, every workstream id, every attendee name, the deal's contact and initiative, and writes nothing at all. Only if the whole thing checks out does phase two run. A refused capture costs you one rejected call and zero rows, instead of half a meeting plus a duplicate contact. Ambiguity is refused, never guessed. If "Sarah" could be two people you already have, it stops and names both. If a decision title fragment matches three decisions, it names all three. What none of that prevents is you approving a sentence that was wrong. It is a record of what you said, and it is exactly as accurate as what you said. It does not fact-check you: tell it the call was Tuesday when it was Wednesday, and it records Tuesday.

Isn't this just a Notion database with a chat box on it?

The storage is not the difference. Two things are. First, the shape of the write surface: nineteen write tools, each named for the past-tense verb in your sentence, so one sentence costs one permission prompt and writes four linked rows. The alternative design — one tool per table — was actually built and measured against this one: 63 tools, six prompts for that same sentence, and a non-atomic sequence that strands a meeting and a deal when you decline the fifth prompt. That is what a chat box over a database gets you. Second, nothing derived is stored. Health, momentum, throughput, time-in-stage and stalled work have no columns; they are recomputed from an append-only trail every time you ask. In a hand-kept database those numbers are fields somebody maintains, which means they are stale, which means nobody trusts them, which is why the database gets abandoned. And the concession: if you would genuinely keep a Notion database current by hand, keep it. It has a dashboard, it has team access, it costs a known amount of money, and this has none of those.

Where does my data actually live, and who can read it?

In a Cloudflare D1 database behind a Cloudflare Worker. D1 is SQL, so whoever holds that Cloudflare account can query the rows directly with wrangler without going through StratOps at all. There is no middle tier holding a copy, no third-party service in the path, and no analytics on your record — the whole thing has zero runtime dependencies. Two things that are usually skipped. First: today there is one deployment, in the Cloudflare account of the person who built it, and there is no self-serve way for you to spin up your own. I would rather say that than let "the database is yours" do work it cannot currently do. Second: you reach it by talking to Claude, so the conversation goes to Anthropic exactly as the rest of your Claude usage does, under whatever terms your plan carries. StratOps does not change that and cannot. And I make no claim about encryption: whatever Cloudflare does by default is Cloudflare's, not something implemented here, and describing it as a security feature of mine would be borrowing somebody else's work.

What if it records the wrong thing — can I undo it?

The most recent capture, yes. retract_capture removes exactly the rows that call created — provenance is a creation stamp, not a link — and keeps anything you have edited since or that another record now points at, telling you which and why. A contact the meeting already knew about is kept, not deleted. That distinction is not academic: treating a link as membership is what once shipped here as real data loss. Anything older, no. There is no general undo, no version history and no trash. Older mistakes are corrected the way you would correct a colleague — you say the correction and the correction is recorded. One specific gap worth knowing: a contact update has no undo at all. It writes only the fields you supply, so a partial update does not erase what is already known, but every field you do supply replaces what was there. That is why an ambiguous name is refused outright rather than guessed at.

Can my team use it?

No. One account, one credential, one person, and it is not a setting. The account row is the identity — there is no user, session, member or role table in any migration, and the bearer token hashes to exactly one account. This is not "multi-user is coming soon": there is currently no mechanism by which a second person obtains a credential short of an operator running SQL by hand, and the credential logic deliberately resolves to nothing rather than guess once a second account exists. A second user needs OAuth, and OAuth is designed and not built. There is a real multi-tenancy layer underneath and it is tested hard — see the probe above — but that machinery exists so the ground is solid when a second person becomes possible. It does not make it possible today.

How do I know my data is isolated from someone else's?

Today the literal answer is that there is nobody else — one account exists. The mechanism is real regardless, and you can measure it rather than trust it. Every parent record carries a tenancy key and every child references the pair, so a row cannot claim one account while pointing at another account's workspace: the database rejects it. A probe makes 55 deliberate cross-account attempts across all 27 tables and 47 are refused by the database itself. The remaining 8 are six columns that can point at any kind of record, where SQLite cannot express such a key; those are guarded in code before every write and re-scoped on every read, and the residual risk there is record pollution rather than disclosure. There is no unscoped path in the code either — no helper anywhere takes an account id as an argument. Now the weakness, because you would find it anyway: 22 of those 27 tables rest on Cloudflare continuing to enforce foreign keys, and nothing in the running system verifies that it still does. Turn enforcement off in the probe and those 22 protections disappear, while the trigger-guarded references survive untouched. The layer most people assume is the stronger one is the layer resting on somebody else's promise. A production canary for it is the first item on the fix list and it is not built.

What does it cost, and what happens when I stop paying?

Nothing, and nothing — there is no price. No plan, no tier, no trial, no card, nothing to cancel, and no free tier being withheld from this page as a tactic. It runs for one person. If it ever becomes purchasable that will be a different conversation and a visibly different page. The real question underneath — will my record be held hostage — has a structural answer rather than a promise: the rows are in a D1 database, which is SQL, readable directly by whoever holds the Cloudflare account, with no proprietary format in the way. There is no export button, which is a real gap. There is also no lock-in.

Is it secure? Do you have SOC 2?

No SOC 2. No compliance certification of any kind, no penetration test, no GDPR position, no data processing agreement, no uptime commitment, and nothing in progress on any of them. If your procurement requires one, stop here — that is not modesty, it is the answer. It would be easy to write a reassuring paragraph about taking security seriously; that paragraph would be worth nothing, and a previous version of this page contained something very like it, which is how it got caught. What does exist is specific and checkable: the token is stored only as a SHA-256, no tool returns a credential, and reads report whether one is set rather than what it is; there is not a single log statement anywhere in the source, so no record body and no token has ever reached a log line; deleting an account cascades all 26 data tables to zero with the other account untouched, verified by a probe; and the data endpoint refuses any request carrying a browser origin outright. What is missing is equally specific: no audit log, so nobody can answer who read what; no rate limiting; and no token expiry, no scopes and no revocation short of an operator clearing the column by hand.

Is my data used to train a model?

StratOps stores your records in its own database and does nothing with them except answer your questions. There is no analytics, no telemetry, no outbound call and no logging. But you reach it by talking to Claude, and what happens to a Claude conversation is governed by Anthropic's terms and the plan you are on — not by anything StratOps controls or can promise. Read Anthropic's policy for your plan. I am not going to make a commitment on another company's behalf, and you should be suspicious of any tool in this category that does.

What happens on day one? I have years of history somewhere else.

Day one is honest and unimpressive, and it is better to know that now than on your first afternoon. Health, momentum, velocity and stalled-work are all computed from a trail of state changes that has to accumulate. There is no stored score — which is what stops them going stale, and equally what stops them existing early. A brand-new account says so outright: health comes back empty with a reason rather than a number. Importing history does not shortcut it, and that is arithmetic rather than opinion: half of momentum is what completed in the last seven days, so a load of finished work scores zero on the largest component. Cold start is the unsolved product risk here and I would rather name it than let you find it. Import is still worth doing for one reason that has nothing to do with the scores — imported timestamps are real, where remembered ones are not. Capture and recall work from the very first sentence; the derived numbers need a few weeks of actually talking to it.

Can I read the source?

Not yet, publicly. The repository is not on GitHub — that is a real open item on the project's list, not a policy — so "open source" is not a claim being made here, and any line on this page implying you could go and run the probe yourself would be false. What I will do is send you the probe file and its output, and walk you through any specific claim on this page against the file it comes from. There is also a written API reference covering all thirty tools, every error a caller can receive, and a numbered list of the gaps an integrator will hit — including the ones that make the product look worse. One of them, for flavour: a north-star metric that improves by going down is scored backwards, because the direction column is stored and never read.

What if you stop working on this?

Then it stops. There is no SLA, no support commitment, no escrow, no roadmap you can hold me to, and no company behind it other than one LLC with one person in it. Anyone telling you otherwise about a product with zero customers is selling you something. The only thing that meaningfully de-risks it: the record is rows in a D1 database. SQL, standard shapes, readable directly by whoever holds the Cloudflare account, with no proprietary format in the way. If this went dark tomorrow the data would still be sitting there in a form any competent person could query.

Why should I believe any of this?

Mostly because of what is missing from it. No customer logos, no testimonials, no rating, no uptime number, no percentage of time saved and no compliance badge — not held back for a later page, but because none of them exist and inventing them is a one-way door. The useful test is not whether you trust me. It is that two of the load-bearing claims — that it is deployed, and that it refuses browsers — take you ten seconds and a terminal to falsify, and the rest come with a file I will send you. And for the avoidance of doubt about how much faith to put in a page like this one: an earlier version of it made four claims the code did not support, including a paragraph about honesty that was itself false. A reader caught them. This one was written against the source — the probe re-run, both suites re-run, the live endpoints checked, and the "two years of history" I was handed cut to six after reading the dates in the export.

10

If this is the thing you keep wishing existed

There is no signup, so there is no funnel. There is one address and a person on the end of it. The email box that used to sit here was disabled and submitted nowhere, and pretending to collect an address is a strange way to open a relationship, so it is gone.

Tell me two things: what you are currently keeping in your head because no tool has earned it, and what you already abandoned trying to keep it somewhere else. If StratOps would help I will tell you how, specifically. If it would not — and for most of the tools people describe to me it would not, because they need a screen or a second seat — you will get that instead, and it will take you one email to find out rather than a month.

jake@aifrontdesk.com

You will get a reply from a person. There is no list, no sequence and no newsletter to unsubscribe from, because none of those exist either.